CVE-2023-6535

Published: 7 February 2024

A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver, causing kernel panic and a denial of service.

From the Ubuntu Security Team

Alon Zahavi discovered that the NVMe-oF/TCP subsystem in the Linux kernel did not properly validate H2C PDU data, leading to a null pointer dereference vulnerability. A remote attacker could use this to cause a denial of service (system crash).

Notes

fixes for CVE-2023-6536, CVE-2023-6535, and CVE-2023-6356
are all the same. the differences between the CVEs are that they were
reported against different methods.
NULL pointer dereference in nvmet_tcp_execute_request

Status

Severity score breakdown

References

• https://lore.kernel.org/linux-nvme/89a927a6-2baf-434a-b1d5-50fb99beca73@grimberg.me/T/#t
• https://www.cve.org/CVERecord?id=CVE-2023-6535
• https://ubuntu.com/security/notices/USN-6765-1
• NVD
• Launchpad
• Debian

Bugs

• https://bugzilla.redhat.com/show_bug.cgi?id=2254053
• https://bugzilla.suse.com/show_bug.cgi?id=1217988